# A malicious lien owner can exploit a reentrancy to steal LP funds

Reentrancy via decreaseYIntercept callback in endAuction lets a lien owner cancel auction, take a new loan, and have its lien deleted, stealing 50 ETH of LP funds.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/187
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reentrancy

**Target:** AuctionHouse.endAuction / decreaseYIntercept callback
**Root cause:** endAuction() calls decreaseYIntercept() which invokes an external callback before deleting the lien token; the callback reenters cancelAuction() and takes a new loan whose lien is then deleted on return.
**Steps:**
1. LP deposits 50 ETH into public vault
2. Borrower takes 10 ETH loan depositing NFT
3. Borrower buys out own lien via `_buyoutLien` paying 10 ETH + fee
4. Borrower lets lien duration expire to trigger liquidation
5. Trigger `endAuction()`
6. Inside `decreaseYIntercept()` callback: call `cancelAuction()` paying reservePrice+initiatorFee, release NFT to self, take new 50 ETH loan with same NFT/vault/commitment
7. Control returns to `endAuction`, deleting the new loan's lien token
8. `CollateralToken.endAuction` releases NFT; borrower keeps 50 ETH with no outstanding lien
**How found:** Manual review of endAuction's external call to decreaseYIntercept before state cleanup, spotting the reentrancy window into cancelAuction and loan origination.
**Exploitation:** Lien owner reenters during endAuction's decreaseYIntercept callback to cancel the auction, reclaim the NFT, and open a fresh 50 ETH loan; the outer endAuction then deletes the new lien, leaving the loan unbacked and draining vault LP funds.
**Escalation:** Reentrancy chains auction cancellation + NFT release + new loan origination to convert a 10 ETH position into 50 ETH theft.
**Insight:** In auction/liquidation flows, check whether external callbacks (yIntercept/interest accrual hooks) fire before lien/token deletion; a reentrant cancelAuction plus fresh borrow can get the new lien wiped by the outer call's cleanup.